CVE-2026-11487: Neovim Command Injection Vulnerability

CVE-2026-11487 Overview

CVE-2026-11487 is a command injection vulnerability in Neovim versions up to and including 0.12.2. The flaw resides in the M.read function of runtime/lua/vim/secure.lua, which is invoked when a user views a trusted-file prompt entry. An attacker who controls a file path processed by this function can inject Ex-mode commands through unescaped path expansion. Exploitation requires local access and user interaction with the View action in the trust prompt. The issue is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and was patched in commit f83e0dcaf8cf18de94828341b0a1a61a86c75baf.

Critical Impact
Local command injection through Neovim's trust-prompt View handler allows attackers to execute arbitrary Ex commands via crafted file paths.

Affected Products

Neovim versions up to and including 0.12.2
Component: runtime/lua/vim/secure.lua
Function: M.read (View branch)

Discovery Timeline

2026-06-08 - CVE-2026-11487 published to the National Vulnerability Database (NVD)
2026-06-08 - Patch commit f83e0dcaf8cf18de94828341b0a1a61a86c75baf referenced as the remediation
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11487

Vulnerability Analysis

The vulnerability stems from unsafe string concatenation when Neovim builds an Ex command from a user-controlled file path. In the View branch of M.read, the fullpath variable is appended directly to the sview command using Lua string concatenation. The runtime then evaluates the assembled string with vim.cmd, so any shell-meta or Vim-meta characters in fullpath are interpreted as command syntax rather than as part of a filename. Successful exploitation runs arbitrary Vim Ex commands in the context of the local user. Because the attack surface is the local trust prompt, exploitation requires the user to choose View on a maliciously named file.

Root Cause

The root cause is missing neutralization of special characters before passing fullpath to vim.cmd. The fix wraps fullpath with vim.fn.fnameescape(), which escapes characters that have meaning to Vim's command parser. Without that escape, characters such as spaces, backticks, and pipes break out of the filename argument.

Attack Vector

An attacker stages a file or directory whose path contains injected Ex syntax in a location a victim is likely to open with Neovim. When the victim is prompted by vim.secure and selects View, Neovim concatenates the malicious path into sview ... and executes the resulting string. Network access is not required; the attack vector is local with low complexity and low privileges.

text

     return nil
   elseif result == 2 then
     -- View
-    vim.cmd('sview ' .. fullpath)
+    vim.cmd(('sview %s'):format(vim.fn.fnameescape(fullpath)))
     return nil
   elseif result == 3 then
     -- Deny

Source: GitHub Commit f83e0dc. The patch replaces direct concatenation with a format string that routes fullpath through vim.fn.fnameescape, neutralizing Vim-significant characters before the command runs.

Detection Methods for CVE-2026-11487

Indicators of Compromise

Files or directories with unusual characters in their names (backticks, pipes, |, <CR>, spaces with :!) that appear in repositories or shared folders opened by Neovim users.
Unexpected child processes spawned by nvim shortly after opening a project containing a .nvim.lua, exrc, or other trust-prompted file.
Trust database entries in stdpath('state')/trust referencing paths with embedded command syntax.

Detection Strategies

Inventory installed Neovim versions across developer workstations and flag any build at or below 0.12.2.
Audit shell history and EDR telemetry for nvim parent processes executing unexpected interpreters or shell commands.
Scan source repositories and shared directories for filenames containing Vim or shell metacharacters.

Monitoring Recommendations

Alert on process-creation events where the parent is nvim and the child is a shell, scripting interpreter, or networking utility.
Monitor modifications to Neovim's trust file and runtime/lua/vim/secure.lua for tampering.
Track package-manager events to confirm the patched Neovim release is deployed enterprise-wide.

How to Mitigate CVE-2026-11487

Immediate Actions Required

Upgrade Neovim to a build that includes commit f83e0dcaf8cf18de94828341b0a1a61a86c75baf from the GitHub Neovim Repository.
Advise users not to select View on trust prompts for unfamiliar project files until the patch is applied.
Review and remove suspicious entries from Neovim's trust database created before patching.

Patch Information

The upstream fix is commit f83e0dcaf8cf18de94828341b0a1a61a86c75baf, delivered via GitHub Pull Request #39918 and tracked in GitHub Issue #39914. The change routes fullpath through vim.fn.fnameescape before invoking vim.cmd('sview ...'). Additional metadata is available at VulDB CVE-2026-11487.

Workarounds

Avoid using the View option in the vim.secure prompt; choose Deny for untrusted files until the patch is installed.
Open suspicious files in a read-only sandbox or container where command execution cannot affect the host.
Disable automatic loading of project-local configuration by setting vim.o.exrc = false until upgrading.

bash

# Verify the installed Neovim version and confirm the patch commit is present
nvim --version | head -n 1
cd /path/to/neovim && git log --oneline | grep f83e0dcaf8cf18de94828341b0a1a61a86c75baf